diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2019-02-07 15:53:26 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2019-02-07 15:53:26 -0700 |
| commit | e303a067ceede918fbf90ff3dc8affbb98bad4e8 (patch) | |
| tree | 13f5048bee966ccf8af6e64c3454c5d8bcc7586e /arch | |
| parent | ee6c0737a0253d6e79063f0a74c1101fdaad0812 (diff) | |
| parent | ecec76885bcfe3294685dc363fd1273df0d5d65f (diff) | |
| download | linux-stable-e303a067ceede918fbf90ff3dc8affbb98bad4e8.tar.gz linux-stable-e303a067ceede918fbf90ff3dc8affbb98bad4e8.tar.bz2 linux-stable-e303a067ceede918fbf90ff3dc8affbb98bad4e8.zip | |
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull KVM fixes from Paolo Bonzini:
"Three security fixes"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221)
KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)
kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/x86/kvm/vmx/nested.c | 1 | ||||
| -rw-r--r-- | arch/x86/kvm/x86.c | 7 |
2 files changed, 8 insertions, 0 deletions
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index 8ff20523661b..d8ea4ebd79e7 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -211,6 +211,7 @@ static void free_nested(struct kvm_vcpu *vcpu) if (!vmx->nested.vmxon && !vmx->nested.smm.vmxon) return; + hrtimer_cancel(&vmx->nested.preemption_timer); vmx->nested.vmxon = false; vmx->nested.smm.vmxon = false; free_vpid(vmx->nested.vpid02); diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 3d27206f6c01..e67ecf25e690 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -5116,6 +5116,13 @@ int kvm_read_guest_virt(struct kvm_vcpu *vcpu, { u32 access = (kvm_x86_ops->get_cpl(vcpu) == 3) ? PFERR_USER_MASK : 0; + /* + * FIXME: this should call handle_emulation_failure if X86EMUL_IO_NEEDED + * is returned, but our callers are not ready for that and they blindly + * call kvm_inject_page_fault. Ensure that they at least do not leak + * uninitialized kernel stack memory into cr2 and error code. + */ + memset(exception, 0, sizeof(*exception)); return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access, exception); } |